# Spark Messenger website — sparkmessenger.wyrs365.com / sparkmsg.wyrs365.com
# Public :443 is stream ssl_preread (see stream.d/spark-sni.conf).
# TLS terminates on loopback :8443 (PROXY protocol from stream).

server {
    listen 80;
    listen [::]:80;
    server_name sparkmessenger.wyrs365.com sparkmsg.wyrs365.com;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 127.0.0.1:8443 ssl proxy_protocol;
    listen [::1]:8443 ssl proxy_protocol;
    http2 on;
    server_name sparkmessenger.wyrs365.com sparkmsg.wyrs365.com;

    ssl_certificate     /etc/letsencrypt/live/sparkmessenger.wyrs365.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sparkmessenger.wyrs365.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SparkSSL:10m;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Mainland CN except Shanghai → Chinese deny page (overseas + Shanghai allow)
    include /etc/nginx/snippets/wyrs-cn-geo-access.conf;

    root /var/www/sparkmessenger.wyrs365.com;
    index index.html;

    location = /favicon.ico {
        try_files /assets/favicon.svg =404;
        default_type image/svg+xml;
        access_log off;
        expires 7d;
    }

    location /assets/ {
        expires 7d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }

    # Marketing site only — never expose API / OpenAPI / architecture docs here.
    location ~* ^/(docs|openapi|swagger|architecture)(/|\.|$) {
        return 404;
    }

    location / {
        try_files $uri $uri/ /index.html;
    }
}